Binary Mutation

Concept

Binary mutation refers to the practice of applying targeted modifications to compiled program binaries—rather than source code—to expose bugs, evade detection, or evaluate test adequacy. Evidence in the provided corpus connects binary mutation primarily to the SearchSYS testing tool, which uses three custom AFL++ mutation operators: a controlled bit-flip operator on compiled binaries, a range-enhanced operator for editing argument values within their specified type range, and an operator for changing a value's type (e.g., INT32 to LONG). Adjacent literature describes binary-level mutation testing for test-suite adequacy (SN4KE) and adversarial binary mutations crafted to evade ML-based malware classifiers.

First seen 8/9/2026

Last seen 8/9/2026

Evidence 4 chunks

Wiki v1

WIKI

Binary Mutation

Definition and Scope

Binary mutation is the deliberate alteration of a compiled program's machine-level representation (instructions, arguments, or type metadata) to study the behavior of a system under test (SUT), assess test-suite adequacy, or—in adversarial contexts—evade detection. Unlike source-level mutation, binary mutation operates on the artifact that is actually executed, which makes it applicable when only the binary form of a program is available.

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

1 connections

SearchSYS ← uses 100% 2e

SearchSYS applies binary mutation as one of its core mutation operators.

LINKED ENTITIES

1 links

SearchSYS USES Extracted graph relationship

CITATIONS

6 sources

6 citations — click to expand

[1] SearchSYS applies three custom AFL++ mutation operators: (1) a controlled bit-flip on the compiled binary, (2) a range-enhanced operator that edits argument values within their specified type range, and (3) an operator that randomly changes an argument's type (e.g., INT to LONG, LONG to STRING). Search+LLM-based Testing for ARM Simulators - SOLAR UCL

[2] SearchSYS adjusts AFL++'s selection so that the bit-flip operator (1) is chosen only 0.5% of the time when AFL++ would otherwise have selected the range-enhanced operator (2), because AFL++ favors operator (1) too heavily due to its low failure risk. Search+LLM-based Testing for ARM Simulators - SOLAR UCL

[3] SearchSYS sets afl_custom_fuzz_count to 17, 84, and 66 for Operators 1, 2, and 3 respectively, to balance iteration-failure risk against per-iteration throughput. Search+LLM-based Testing for ARM Simulators - SOLAR UCL

[4] After fuzzing, SearchSYS performs differential testing by running mutated binaries on real ARM hardware and on the gem5 simulator with the ARM ISA, treating output mismatches as candidate missimulation bugs (following Even-Mendoza et al.). Search+LLM-based Testing for ARM Simulators - SOLAR UCL

[5] SN4KE proposes binary mutation analysis via binary rewriting, with a richer set of mutation operators representing more realistic bugs, implemented on two binary-rewriting tools and evaluated on SPEC CPU; reassembleable disassembly rewriting scales better than lifting to an IR and performing full translation. SN4KE: Practical Mutation Testing at Binary Level

[6] Adversarial binary mutations can be discovered via Monte Carlo tree search against an ML-based malware classifier surrogate trained on EMBER-2018, enabling evasion of a victim classifier in a grey-box setting. Evading Malware Classifiers via Monte Carlo Mutant Feature Discovery